Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Leaking actual server name with Reverse proxy #197

Open
GoogleCodeExporter opened this issue Jun 4, 2015 · 1 comment
Open

Leaking actual server name with Reverse proxy #197

GoogleCodeExporter opened this issue Jun 4, 2015 · 1 comment

Comments

@GoogleCodeExporter
Copy link

What steps will reproduce the problem?
1. Set up RP behind a reverse proxy with machine name as 
Machine_name.domain.com(FQDN)
2. Start an OpenID authentication request to an OpenID provider by accessing 
Reverse proxy say example.domain.com
3. You will find "Machine_name.domain.com is asking for some information from 
your Google Account. "



What is the expected output? What do you see instead?
It should display "example.domain.com is asking for some information from your 
Google Account" instead of "Machine_name.domain.com is asking for some 
information from your Google Account"

What version of the product are you using? On what operating system?
openid4java-0.9.7

Please provide any additional information below.
If the application is configured with reverse proxy, then what security does it 
provides by displaying the actual server name (Machine_name.domain.com) to the 
end user?



Original issue reported on code.google.com by [email protected] on 10 May 2013 at 10:23

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant